Crossposted from my Substack, sofiayab.substack.com. A bit about me: I studied law in Chinese at Fudan University and did an MSc in China in Comparative Perspective at LSE. I am Head of Legal at an AI company, and an incoming Winter Fellow at GovAI (2027). Views in the article are my own.
This is the second issue of my monthly series on China's AI safety regulation. It covers the main developments from mid-September to 25 October 2026.
This monitor is for AI governance researchers who would like to understand Chinese regulation more deeply, as well as for anyone interested in how existing legal systems change to govern more autonomous AI.
Courts distinguish software agents from physical AI. The Supreme People’s Court’s Opinion uses a fault-based approach for software-based generative AI, which means that harm alone does not establish liability: another necessary element is whether the provider is at fault. The official commentary to the Opinion says that greater autonomy raises developers’ and providers’ duty of care relative to users. The standard becomes harsher when AI is embodied: robots and autonomous vehicles are likely to qualify as products under the Product Quality Law, and producers may face no-fault product liability, where proving harm and the product defect is enough.
The Tencent incident exposes a gap in agent rules. Current binding rules focus on legally defined conduct and effects (such as unlawful network access, improper data collection or resulting harm) instead of treating an agent’s loss of scope as a violation in itself. China has no general AI-specific reporting duty for this kind of incident.
A map of China’s open-weight regulations. Taken together, China’s disparate rules encourage public release of open-weight models while retaining stronger control over private technology transfers, public-facing services and dangerous capabilities. Under the new draft export catalogue, technology made public before 16 October 2026 falls outside the proposed catalogue’s management. A temporary measure already in force requires exporters of listed technologies and covered transfers to register with the Ministry of Commerce before export, rather than seek a licence under that measure.
How the filing regime and the Ethics Measures apply to agentic AI. On 23 October, the Central Cyberspace Affairs Commission published the National Informatization Plan for the 15th Five-Year Plan period. It calls for improving generative AI filing, safety-risk assessments in key sectors, and assessment and filing for agents, on-device large models and anthropomorphic interaction services. This creates an additional effect for Article 26 of the AI Ethics Review Measures according to which external expert re-review may be skipped where another regulatory process includes ethics compliance. CAC filing could become an ethics-oversight channel, but public materials do not show that CAC currently conducts an ethics review or that the exemption has been used.
October implementation tracker: safety disclosures and filing lists. Moonshot published a cyber-risk evaluation and mitigation account for Kimi K3.1 Pro. MiniMax published a CyberGym result for M3.1 Flash. Neither has committed to regular fix-cadence disclosures. CAC published no new regular national filing batch after 14 September; I found no filing notice in October through 5 November.
October implementation tracker: AI legislation and standards. No official national AI law draft has been published. The 2026 State Council plan calls for comprehensive legislation on healthy AI development, while the National People’s Congress plan calls for research and drafting, with deliberation to be arranged if conditions permit. A mandatory agent safety standard project (20263116-Q-252) remains at the drafting stage, and its full text is not public.
In September, Zhou Jiahai, the director of the Supreme People's Court Research Office, and several colleagues published a detailed commentary on the Supreme Court’s AI opinion that I discussed in my previous issue. The authors of the commentary participated in drafting the original AI opinion, so even though the commentary is not binding, it is an important guide to how the Supreme Court expects lower courts to read it.[1]
In the last issue, I mentioned that the opinion used a “fault-based” liability approach under which the court must find that the AI provider failed to take reasonable measures to prevent or reduce the harm, as opposed to being liable just because harm occurred. In the view of the commentators, the reason for adopting the “fault-based” liability approach is that AI models mainly provide information and generally do not directly endanger people or property.
I argue that this might be the case for a chatbot, but is less true for agentic AI. The Tencent case discussed in the next section of this article is an example of that: an AI system was calling tools, changing routes when deemed necessary, and using keys and security codes they found in public repositories of other users to access the desired online environments. The OpenAI HuggingFace incident is another obvious example. When an agent makes decisions and acts autonomously and continuously in the world, the legal distinction between “providing information” and actively creating danger is much less straightforward.
The commentary does address this problem to some extent, by saying more explicitly than the original Opinion that greater AI autonomy raises the duty of care for providers relative to users. The commentary also explains that technical and information transparency (how transparent a provider is about the model’s capabilities) includes clear warnings about the system’s limitations and legal risks. [2]
Interestingly, the regulatory standard becomes harsher in cases where AI is embodied. Robots and autonomous vehicles are likely to qualify as products under the Product Quality Law, and producers may face no-fault product liability. That means a claimant needs to prove a product defect, the damage, and a causal link between the two, without having to prove that the producer was negligent.[3] One factor for determining whether a robot is defective is whether it complies with national and industry standards.[4]
I think this distinction is interesting to observe through a real-world example. An incident has been reported in Xiangyang where a Unitree robot injured a person during a public event. The family settled with the venue, so the case did not reach a court. If we imagine it did go to court today, the injured person could build their case using two legal routes directed at different parties: 1) they could sue the robot producer under product-liability rules as described above, proving that the robot was defective; 2) or they could sue the event organizer under the Civil Code's rule requiring organisers of public events to take reasonable safety measures.[5]
For the product claim, the national technical standard used as a factor for deciding defectiveness could potentially be GB/T 39785-2021 – the standard on mechanical safety assessment for service robots. It covers physical collision avoidance, protective stops and limits on the robot's operating space. China has also recently approved six recommended (non-binding) technical standards for humanoid robots, and several recommended humanoid safety standards are currently being drafted or are at the public-comment stage (Emmie Hine gives a useful overview in China AI Bulletin 14). As recommended standards, they are not directly binding, but the Supreme Court’s AI opinion allows judges to consider them when assessing defects.[6][7]
This example shows that the harshest liability rule applies to physical AI products, while as I said above software-based AI systems (including the most capable and autonomous agents) are subject to a lighter, fault-based liability approach. In contrast, the EU's new Product Liability Directive treats software as a product.[8]
The legal importance of agents’ potential for misaligned action is illustrated by a recent Tencent incident. It happened between September and October this year, making it one of the first publicly reported Chinese cases of this kind.
Tencent provided third-party models with agent harnesses and tested how well they could complete tasks in a sandbox. The company has not publicly identified the models, nor did it say whether they were open-weight or API-based. Some agents described themselves as "Claude", but the outside researchers who reported the incident noted that a self-description does not establish which model was really operating.
Between 28 September and 8 October, some of the agents made more than 2,600 attempts to obtain data from Amap, Alibaba's map service (roughly China's equivalent of Google Maps). When direct requests were blocked by Amap, the agents used public web tools, routed requests through other websites and used Amap API keys that other companies had accidentally exposed in public code.
Based on the known facts, no one instructed the agents to circumvent Amap's restrictions. Rather, they simply continued pursuing the task and saw Amap blocking them as an obstacle. It is reasonable to say that this behavior was outside the apparent scope of the user's intent and authorization, although we do not know the prompts and the specific agent setup.[9]
Outside researchers discovered the agents’ activity by tracing requests to infrastructure associated with Tencent Cloud's Hong Kong data centre. Tencent confirmed the incident after the researchers’ report and said it occurred while evaluating third-party models rather than its own Hunyuan AI models. As of 3 November, I found no public response from the Cyberspace Administration, the Ministry of Industry and Information Technology, the Ministry of State Security, or any other state body.[10]
China currently has a rule targeting agents that act beyond the authorised scope—the Implementation Opinions on AI Agents (May 2026)—but it is non-binding (soft law). I have not found a similar rule in a binding AI regulation.[11]
Existing binding cybersecurity and data law may apply to what happened. Specifically, I found several possible hooks. The Cybersecurity Law prohibits illegal intrusion and theft of network data, while the Data Security Law requires data to be collected by lawful and proper means. The Network Data Security Regulations specifically say that a processor using automated tools to access or collect network data must assess its impact on the service and must not intrude into another network or interfere with its operation. The Anti-Unfair Competition Law also covers cases where a business operator obtains another operator's data by circumventing technical management measures.[12]
However, I am not sure how likely these provisions are to apply to the Tencent case. For example, we cannot determine based on the publicly available facts whether the agents successfully defeated (as opposed to circumvented) Amap's anti-bot defences, how much data they obtained, whether the access caused measurable harm or which actor controlled the steps.
This incident demonstrates that the current binding law tries to address the impact of an agent’s actions such as unlawful access to an external network, or the realised harm, instead of seeing the agents’ misaligned conduct itself as a violation.
There is an incident reporting duty under China’s Cybersecurity Law, however, the reporting obligation applies when a network operator identifies an incident involving its network that is at least “relatively serious”. Besides, the reporting duty also may fall on the operator of the affected network (Amap, rather than Tencent).[13]
The EU AI Act offers one comparison: it requires providers of general-purpose AI models with systemic risk to report serious incidents to the AI Office and, where appropriate, national regulators. China has no comparable AI-specific duty for this kind of event.[14]
The practical question is therefore not whether Chinese law can punish any harm caused by an agent. It often can. The harder question is who must detect and disclose an agent's loss of scope before serious harm occurs.
Chinese authorities’ silence is especially ironic because Chinese official sources had already commented publicly on two OpenAI-linked agent incidents. An August Xinhua article reported on the Hugging Face incident; on 17 September, the Ministry of State Security publicly criticised the way the DseWiki incident (OpenAI agents using the German programming website as their message board) had been handled, in an article republished by the Ministry of Justice. The ministry said the companies involved did not promptly disclose the details of the incident or issue a risk warning. Yet, as of 3 November, I found no comparable public response from a Chinese authority to the Tencent-linked case (although we cannot know whether any actions were taken privately by the officials).[15]
The case also raises a question about the US–China communication channel for AI incidents, which Xi and Trump agreed to establish at their September summit. The Tencent agents’ activity began only days after that agreement was made. However, since then, neither government has publicly defined an “AI incident,” whether incidents arising during internal model testing are covered, or when the channel starts to operate. There is no public evidence that this case was communicated through the channel. So the ambiguities discussed in the previous issue remain unresolved.[16]
China’s regulation of open weight models is done through various legal mechanisms in trade law, AI service filing (discussed in issue 1), Supreme People’s Court guiding documents, enforcement campaigns and technical standards. Seen as a whole, the message they communicate is about encouraging public release of AI models, while retaining stronger control over private technology transfers, public services and particular dangerous capabilities.
On 16 October, the Ministry of Commerce and the Ministry of Science and Technology published a co-authored draft revision of the catalogue of technologies prohibited or restricted from export. The draft is open for comments, and there are still several steps before it could become law: its effective date is not specified (previous catalogue revisions have often taken around a year from a public comment round to final release); it may also change or stall before it becomes law.[17]
Notably, one of the proposed changes concerns public technology. The draft suggests that technology that has already been made public through open-source release or academic papers is not subject to export restrictions under this rule. However, if a company wanted to open-source restricted technology in the future, it could use automatic licensing. “restricted” here means falling under one of the categories listed in the draft, which is fairly broad and is likely to cover at least some frontier LLMs (‘Large models trained using China’s “important data” and subsequently used to provide services’). For technologies on the list, AI providers would need to report to the state before exporting them. The state attempts to make the process as seamless as possible by introducing the approach "report and export immediately" (即报即出), which means the exporter would apply and the license would normally be issued immediately.[18]
However, automatic licensing is still a license, and licensing, being a mechanism of control, usually implies the possibility of a license refusal. The draft does not explicitly say whether the Ministry can refuse it in an exceptional case. From the public rules I could find, in the past China has used this automatic licensing mechanism for physical goods only, so this would be a new process for AI technology, assuming the draft makes it to the final stage and becomes law.[19]
The draft also distinguishes between getting access to technology (via API, app or web service) and localized deployment. The former is generally not treated as exporting the underlying technology, while the latter, if done overseas, falls within the definition of technology transfer and is governed. Deployment on the Chinese AI developer’s own overseas cloud may enjoy the automatic licensing described above.[20]
While the published document is a draft, a temporary registration system has been introduced which is already in force. Starting 16 October, exporters of technologies listed in the draft annex must notify the Ministry of Commerce before the transfer, as well as provide basic information about the technology, the recipient and intended use. So the approach currently in force requires AI developers to notify the state rather than seek a license.[21]
China's generative AI filing rules cover services offered to the public. But the act of publishing model weights for free is not, by itself, the provision of a public-facing generative-AI service and therefore doesn’t have to go through the CAC filing process (while, say, a publicly available chatbot built on those open weights can still need to undergo filing and a security assessment). This distinction between open weight public release and closed-weight deployment is further discussed in issue 1, and is important for the purposes of creating the map of open weights regulations.[22]
The Supreme People's Court’s AI Opinion is another important element of the open weights regulation map. Item 13 of the opinion allows courts to exempt some free open-source developers from tort liability provided they had publicly explained the functions and security risks of the code they provide. The Court's additional commentary to the Opinion (discussed in more detail above) says that the exemption does not cover commercial open-source activity and is discretionary.[23]
Disclosure of the functions and security risks of open-source models may therefore exempt some free open-source developers from liability. It is distinctive that the exemption is conditional on this disclosure.
Another element I’ve added to the open weights regulations map is enforcement. In its 6 July report on the first phase of the Qinglang campaign, CAC reported that nine open-source datasets were “dealt with” (meaning that regulatory measures were applied, but it is unknown which specifically and to which parts of the models). The campaign, however, focused mainly on compliance by public-facing AI products and on online content. Regulatory action against nine open-source datasets suggests that open-source AI resources remain subject to some state oversight. However, this falls far short of a general safety-assessment framework for open-weight models.[24]
Situation | Regulatory approach | Status |
|---|---|---|
Technology already public today (through open source or papers) | Outside technology export management under the proposed cataloguea | Draft |
Future open-sourcing of restricted technology | Automatic licence described as “report and export immediately”b | Draft |
API-based or web access | Not treated as export of the underlying technologyc | Official Q&A on draft |
localized deployment overseas | Treated as technology export; Chinese AI provider’s own overseas cloud may receive automatic licensingd | Official Q&A on draft |
Free publication of model weights | Not subject to pre-market release filing duty because is not itself a public-facing generative AI servicee | Current rules |
AI service released publicly, built on open weights | May require filing and a security assessmentf | Current rules |
Free open-source code + its main functions and risks are disclosed by the provider | Court may exempt the provider from tort liability if the model causes harmg | Judicial guidance |
Sources: a MOFCOM spokesperson, Q&A on the catalogue revision, sections on technology already made public and automatic licensing, 16 October 2026, link. b MOFCOM spokesperson, Q&A on the catalogue revision, explanation of the proposed automatic-licensing mechanism, 16 October 2026, link. c MOFCOM spokesperson, Q&A on the catalogue revision, sections on cross-border services, overseas use and localised deployment, 16 October 2026, link. d MOFCOM spokesperson, Q&A on the catalogue revision, sections on cross-border services, overseas use and localised deployment, 16 October 2026, link. e Cyberspace Administration of China (CAC), Interim Measures for the Management of Generative AI Services, arts. 2 and 17, 13 July 2023, link. f Cyberspace Administration of China (CAC), Interim Measures for the Management of Generative AI Services, arts. 2 and 17, 13 July 2023, link. g Supreme People's Court, Opinion on Adjudicating AI-Related Disputes, item 13, 7 September 2026, link; Zhou Jiahai et al., official commentary on the opinion, 9 September 2026, link.
The overall regulatory pattern is permissive towards publicly releasing models’ weights. At the same time, China preserves more control at the points where AI technology is transferred privately, becomes a public service, enables a prohibited capability or is used to cause harm.
Matt Sheehan and Scott Singer note that Framework 2.0 was the first authoritative Chinese discussion of open-weight risks, but they believe the countermeasures the Framework proposed were unsatisfying.[25] The map of the binding rules above shows that there is still a gap.
In issue 1 I discussed the process that AI providers need to go through before releasing their product on the market. Currently, the filing system mostly checks content rules compliance and is limited to public-facing services. This October, a new National Informatization Plan was introduced, calling for improved assessment and filing for agents and other forms of AI. I would like to also look at how these future changes will intersect with the current laws.
In China today, some products with agent capabilities enter the existing generative-AI filing system. For example, on 23 September, CAC announced that YOYO Claw, an agent developed by Honor, had completed filing as a generative-AI service. The current version of the filing notice classifies it as an on-device service, providing no information about the agent’s autonomy, permissions or access to tools.[26]
On 23 October, the Central Cyberspace Affairs Commission published the National Informatization Plan for the 15th Five-Year Plan period. It calls for optimising generative AI filing, establishing safety-risk assessment for applications in key sectors, and improving assessment and filing for agents, on-device large models and anthropomorphic interaction services. It also identifies AI as an area requiring foundational legislation and calls for judicial interpretations on AI-related questions.[27]
This is a Party policy plan, not a generally binding law. It was issued by the Central Cyberspace Affairs Commission which is a Party body, but the Commission and the CAC share leadership and operate jointly. Because of these close ties, in practice, the Commission's policy direction can be translated into state regulation through the CAC. The plan therefore does not create a general duty for AI providers, but rather signals that future policy will change to accommodate the suggested changes in the filing system.
The proposed changes in the filing system will interact with the existing laws, such as the Measures for AI Science and Technology Ethics Review and Services (March 2026). The measures require an expert re-review of internal AI research for the following research types: 1) human-machine integrated systems with a strong influence on behaviour, emotions, life or health; 2) models and systems “with public-opinion or social-mobilisation capacity”; and 3) highly autonomous decision systems used in settings involving safety or personal health risks.[28]
These activities are reviewed more often and more closely than other types of research: normally, reviews must happen at least every 12 months, but for the activities listed above, the interval is six months, and these activities must be registered on the national science and technology ethics platform, with an annual report on their implementation.
These categories overlap with the filing regime significantly: for example, type 2 uses almost the same language as the rules introducing the filing regime (services ‘with public-opinion attributes or social-mobilisation capacity’ must file under the algorithm, deep-synthesis and generative AI rules); while agents used in safety-related setups may fall under type 3 ("highly autonomous decision systems").[29]
However, Article 26 of the Measures creates a possible exception allowing an activity to skip the external expert re-review if an AI activity is already subject to registration, filing or administrative approval under the deep-synthesis, algorithm-recommendation or generative AI regimes, and ethics compliance is an approval condition or part of the regulatory content. The Chinese version says "may", not "shall", so I assume this exemption is a possibility rather than something happening automatically for all applicable cases.[30] The filing regimes already include ethics in their regulatory content: the algorithm-recommendation, deep-synthesis and anthropomorphic-interaction rules require providers to establish an S&T ethics review system, while the generative AI measures require respect for ethics.[31] Therefore, many filed activities could be qualified for the exemption. I expect that more activities may be covered by the exemption as the filing system develops further to include agentic AI and anthropomorphic services.
It is important to note, however, that regardless of the exemption, the AI provider’s internal ethics committee (or an authorized partner) must still conduct the research review; in the exempt cases, only the external review layer is absent. It is also unclear whether authorities treat these ethics provisions as ‘regulatory content’ within the meaning of Article 26 (I have not found public evidence demonstrating how CAC checks ethics compliance in practice).
The filing system run by CAC may therefore play a double role: 1) grant or deny market access, and 2) oversee ethical compliance. But it is still unclear what ethics content the CAC filing mechanism examines.
This tracker covers new binding rules, AI labs’ practices, court reasoning and public reporting. It covers publicly available evidence concerning October 2026.
I have reorganized the tracker in this issue. Items without a relevant development have been omitted for this issue, but they remain part of my longer-term monitoring project. The Public visibility column tracks whether each change makes dangerous capabilities more or less visible to the general public.
Issue and tracked content | October 2026 status | Public Visibility levels |
|---|---|---|
Use of the AI Safety Governance Framework 3.0. This is a non-binding national AI-safety framework. I track whether courts, regulators, technical standards or AI developers cite it, as a measurement of its practical authority. | The Foreign Ministry explicitly cited Framework 3.0 on 15 September. I found no explicit citation by a court, regulator or within a regulation in October. The Framework’s language concerning “endogenous and derivative risks” appeared in two later official statements (one by China's UN ambassador and one by the Ministry of Commerce) without explicit attribution to the Framework.a | Unchanged |
Safety disclosures by frontier-model developers. I track whether five Chinese frontier-model developers publish model security assessments, audits, or reports on incidents and anomalous behavior; and whether they mention Framework 3.0. | Moonshot published a detailed cyber-risk evaluation and mitigation account for Kimi K3.1 Pro. MiniMax published cyber-capability testing for M3.1 Flash. They do not cite Framework 3.0, and there is no signal that disclosures are going to be regular. Separately, the Supreme Court commentary discussed above gives developers who provide open-source models for free a possible liability incentive to disclose their functions and security risks. Such disclosure can potentially exempt a developer from liability if the model causes harm.b,c | Slightly up |
Human control and shutdown mechanisms: whether binding rules ask for human oversight over models, circuit breakers or emergency stopping mechanisms for agents or robots.d,e,f | No binding rule for general-purpose software agents. Non-binding agent guidance limits operations to user authorisation. Humanoid-robot safety standards are at the drafting stage (see this issue for more). | Unchanged |
New binding rules and important non-binding guidance on AI safety: new laws, regulations, mandatory standards and important guidance relevant to AI safety. | Binding agent-safety standard (plan 20263116-Q-252) is at drafting stage, no full text published yet. TC260's draft Agent System Development Security Guide closed for comments on 2 October; I found no final version published by 5 November.g,h | Unchanged |
AI incident reporting: whether frontier developers must report AI-safety incidents; which authority receives the reports; whether any information becomes public.i | No AI-specific reporting requirement. The Tencent event was found by outside researchers and confirmed by the company; no regulator response was found. | Unchanged |
Export controls on AI technology: whether the proposed technology catalogue has become law and which transfers require registration or licensing.j,k | The catalogue by the Ministry of Commerce and the Ministry of Science and Technology discussed in this issue is a draft at the public-comment stage (open until 15 November). An interim pre-export registration requirement has been in force since 16 October concerning the annexed technologies and specified forms of technology transfer. “Registration” can be achieved by notifying the Ministry of Commerce on its platform. It will remain effective until the catalogue formally enters into force. MOFCOM and MOST Announcement No. 48. | Not applicable |
National AI legislation: whether China publishes a draft of a general AI law or adopts other foundational AI legislation. | No official national AI-law draft has been published. However, the project is already in preparation: the 2026 State Council plan requests comprehensive legislation on healthy AI development; the National People’s Congress plan asks relevant bodies to conduct research and drafting, with possible consideration by the NPC at a later stage. The October Informatization Plan discussed in this issue reinforces the same direction by calling for foundational AI legislation and AI-related judicial interpretations.l | Not applicable |
Public generative-AI filing lists. I track frontier-model releases or updates by analyzing publicly visible filing lists for generative AI services offered to the public. | No new regular national batch list since 14 September. That September notice covered the July–August period, reporting 124 newly filed services and 133 registered applications or functions. CAC separately announced three newly filed on-device services on 23 September. No October batch notice was found through 5 November.m | No new data |
AI ethics review. I track which AI activities require ethical review by external experts, and the changes to that process. | Implementation is taking place. MIIT’s “pilot” from June to November covers ten provincial-level jurisdictions, requiring each provincial authority to conduct at least three expert re-reviews during the pilot. Jiangsu’s first AI ethics-review service centre has opened in Nanjing. Article 26 of the Ethics review measures (the exemption for filed services discussed in this issue) is possible only where the other filing, registration or approval process treats ethics compliance as an approval condition. I found no publicly documented case in which this exemption was applied.n,o | Unclear / mixed Article 26 exemption may reduce scrutiny by external experts; however, the pilot expands expert review. |
Sources: a Ministry of Foreign Affairs, regular press conference, 15 September 2026, link; Ministry of Foreign Affairs, statement by China's Permanent Representative to the United Nations, 26 September 2026, link; MOFCOM spokesperson, Q&A on the technology-export catalogue revision, 16 October 2026, link. b Moonshot AI, 'Kimi K3.1 Pro', official model release note, link; MiniMax AI, 'MiniMax-M3.1-Flash', official model card, link. c Supreme People's Court, Opinion on Adjudicating AI-Related Disputes, item 13, 7 September 2026, link; Zhou Jiahai et al., official commentary on the opinion, 9 September 2026, link. d CAC, National Development and Reform Commission and Ministry of Industry and Information Technology, Implementation Opinions on the Standardised Application and Innovative Development of AI Agents, part III.1.6, 8 May 2026, link. e National Standards Information Public Service Platform, General Security Requirements for Artificial Intelligence Agent Application, project 20263116-Q-252, link f State Administration for Market Regulation, GB/T 39785-2021, Service Robots—Mechanical Safety Assessment and Testing Methods, especially sections 5.4.2-5.4.4, link; Announcement No. 43 of 2026 approving six recommended humanoid-robot standards, link; draft humanoid-robot safety standard plan 20261658-T-604, link. g National Standards Information Public Service Platform, General Security Requirements for Artificial Intelligence Agent Application, project 20263116-Q-252, link h National Information Security Standardization Technical Committee (TC260), Cybersecurity Standardization Work Monthly Report, August-September 2026, 22 September 2026, link i CAC, National Cybersecurity Incident Reporting Measures, 15 September 2025, link. j Ministry of Commerce (MOFCOM) and Ministry of Science and Technology, Announcement No. 48 of 2026, 16 October 2026, link; MOFCOM spokesperson, Q&A on the catalogue revision, 16 October 2026, link. k MOFCOM and Ministry of Science and Technology, Announcement No. 48 of 2026, 16 October 2026, link. l State Council, 2026 Legislative Work Plan, link; National People's Congress Standing Committee, 2026 legislative work plan (officially reproduced by the Jiangsu Provincial People's Congress), link; Central Cyberspace Affairs Commission, National Informatization Plan for the 15th Five-Year Plan Period, link. m Cyberspace Administration of China, notice covering the July-August 2026 filing batch, 14 September 2026, link; notice on three on-device generative AI services, 23 September 2026, link. n Ministry of Industry and Information Technology, notice on the 2026 AI ethics-review pilot, link; Nanjing Municipal Government, report on the Nanjing AI Ethics Review Service Centre, 7 July 2026, link; Measures for AI Science and Technology Ethics Review and Services (Trial), art. 26, link. o Measures for AI Science and Technology Ethics Review and Services (Trial), art. 26, 20 March 2026, link.
Something to observe during the next several months is whether any mechanism emerges that connects these disparate systems.
If there is a Chinese rule, standard, court case or filing that you would like me to examine, send me an email at s.yablonskaia@gmail.com or leave a comment. I analyse legal texts and the context around them, using primary Chinese-language sources, so I can help interpret a document, or understand what its actual legal status is.
This is the second issue of my series and I am still contemplating the final format. I would really like to know which sections were most useful, what was unclear, and whether the article length is right.
Corrections are super welcome. If you work on Chinese regulations and think I have misinterpreted or missed something, please tell me. I will correct it in the next issue and credit you if you’d like.
A question for China AI governance researchers: has anyone seen the exemption from Article 26 of the AI ethics review measures applied in practice, such as a case where a filed AI service was freed from the external expert re-review requirement? Any pointers would be very useful.
Zhou Jiahai, Si Yanli, Qin Yuanming, Jia Yuhui and Zhang Yin, Supreme People's Court, official commentary on the Opinion on Adjudicating AI-Related Disputes, 9 September 2026, https://ipc.court.gov.cn/zh-cn/news/view-6039.html.
Zhou Jiahai et al., official Supreme People's Court commentary, discussion of autonomy, control, risk warnings and the duty of care, 9 September 2026, https://ipc.court.gov.cn/zh-cn/news/view-6039.html.
Zhou Jiahai et al., official Supreme People's Court commentary, discussion of product and fault-based liability, 9 September 2026, https://ipc.court.gov.cn/zh-cn/news/view-6039.html.
Product Quality Law, arts. 41 and 46, official text, https://www.cnipa.gov.cn/art/2019/7/31/art_104_67810.html; Civil Code, arts. 1202-1207, National Laws and Regulations Database, https://flk.npc.gov.cn/.
China Newsweek, report citing the Xiangyang Science and Technology Museum operator's account of the incident and settlement, 26 August 2026, https://www.inewsweek.cn/finance/2026-08-26/31745.shtml. This is the only secondary source used for the incident itself; the legal analysis relies on the primary laws cited above. Civil Code, art. 1198, National Laws and Regulations Database, https://flk.npc.gov.cn/.
State Administration for Market Regulation, GB/T 39785-2021, Service Robots—Mechanical Safety Assessment and Testing Methods, especially sections 5.4.2-5.4.4, https://std.samr.gov.cn/gb/search/gbDetailed?id=BD89DE8E07373D08E05397BE0A0A4FAD; Announcement No. 43 of 2026 approving six recommended humanoid-robot standards, https://std.sacinfo.org.cn/gnoc/queryInfo?id=97F1A262B6F0884B5FBA52BD88D6F450; draft humanoid-robot safety standard plan 20261658-T-604, https://std.samr.gov.cn/gb/search/gbDetailed?id=4E645DFFD63A7395E06397BE0A0AE96A; Supreme People's Court, Opinion on Adjudicating AI-Related Disputes, item 9, 7 September 2026, https://www.court.gov.cn/zixun/xiangqing/511101.html.
Emmie Hine, 'China AI Bulletin 14', China AI Bulletin, 23 October 2026, https://chinaaibulletin.substack.com/p/china-ai-bulletin-14.
Directive (EU) 2024/2853 on liability for defective products, including software within the definition of a product, https://eur-lex.europa.eu/eli/dir/2024/2853/oj.
Swarmchasers, investigation report on the Tencent-linked agent activity, 14 October 2026, https://swarmcha.se/posts/chinese-agent-fleet-full-report.
Tencent Hunyuan, statement on the evaluation of third-party models, 16 October 2026, https://x.com/TencentHunyuan/status/2110885021280268664; Swarmchasers, full report, https://swarmcha.se/posts/chinese-agent-fleet-full-report.
CAC, National Development and Reform Commission and Ministry of Industry and Information Technology, Implementation Opinions on the Standardised Application and Innovative Development of AI Agents, part III.1.6, 8 May 2026, https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm.
Cybersecurity Law, Data Security Law and Civil Code texts are available through the National Laws and Regulations Database, https://flk.npc.gov.cn/; Network Data Security Regulations, art. 18, https://www.cac.gov.cn/2024-09/30/c_1729384452307680.htm; amended Anti-Unfair Competition Law, https://www.cnipa.gov.cn/art/2026/5/20/art_104_206437.html.
CAC, National Cybersecurity Incident Reporting Measures, 15 September 2025, https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm.
Regulation (EU) 2024/1689 (AI Act), art. 55(1)(c) and related serious-incident provisions, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689.
Xinhua, report on the OpenAI-linked Hugging Face incident, 27 August 2026, https://www.news.cn/tech/20260827/9bfa3a7e747c45a897900bfa9526a43a/c.html; Ministry of State Security advisory, officially republished by the Ministry of Justice, 17 September 2026, https://legalinfo.moj.gov.cn/zhfxfzzx/fzzxrdtj/202609/t20260917_539828.html.
Ministry of Foreign Affairs, 'China and the United States Reach Eight Deliverables and Understandings', 26 September 2026, https://www.mfa.gov.cn/eng/zy/jj/xjpdmgjxgsfw/202609/t20260926_12031663.html.
Ministry of Commerce (MOFCOM) and Ministry of Science and Technology, Announcement No. 48 of 2026, 16 October 2026, https://www.mofcom.gov.cn/zwgk/zcfb/art/2026/art_0a31a3c9ac404f7a9b0e917ce3412997.html; MOFCOM spokesperson, Q&A on the catalogue revision, 16 October 2026, https://www.mofcom.gov.cn/syxwfb/art/2026/art_a4acff07e134447fbe7bbeb486df3ea6.html.
MOFCOM spokesperson, Q&A on the catalogue revision, sections on technology already made public and automatic licensing, 16 October 2026, https://www.mofcom.gov.cn/syxwfb/art/2026/art_a4acff07e134447fbe7bbeb486df3ea6.html.
MOFCOM spokesperson, Q&A on the catalogue revision, explanation of the proposed automatic-licensing mechanism, 16 October 2026, https://www.mofcom.gov.cn/syxwfb/art/2026/art_a4acff07e134447fbe7bbeb486df3ea6.html.
MOFCOM spokesperson, Q&A on the catalogue revision, sections on cross-border services, overseas use and localised deployment, 16 October 2026, https://www.mofcom.gov.cn/syxwfb/art/2026/art_a4acff07e134447fbe7bbeb486df3ea6.html.
MOFCOM and Ministry of Science and Technology, Announcement No. 48 of 2026, 16 October 2026, https://www.mofcom.gov.cn/zwgk/zcfb/art/2026/art_0a31a3c9ac404f7a9b0e917ce3412997.html.
Cyberspace Administration of China (CAC), Interim Measures for the Management of Generative AI Services, arts. 2 and 17, 13 July 2023, https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm.
Supreme People's Court, Opinion on Adjudicating AI-Related Disputes, item 13, 7 September 2026, https://www.court.gov.cn/zixun/xiangqing/511101.html; Zhou Jiahai et al., official commentary on the opinion, 9 September 2026, https://ipc.court.gov.cn/zh-cn/news/view-6039.html.
CAC, report on the first phase of the Qinglang campaign against irregularities in AI applications, 6 July 2026, https://www.cac.gov.cn/2026-07/06/c_1785081384384987.htm.
Matt Sheehan and Scott Singer, 'How China Views AI Risks and What to do About Them', Carnegie Endowment for International Peace, 16 October 2025, https://carnegieendowment.org/research/2025/10/how-china-views-ai-risks-and-what-to-do-about-them.
CAC, notice on three on-device generative AI services, 23 September 2026, https://www.cac.gov.cn/2026-09/23/c_1791913977404975.htm.
Central Cyberspace Affairs Commission, National Informatization Plan for the 15th Five-Year Plan Period, 23 October 2026, https://www.cac.gov.cn/2026-10/23/c_1794509028407372.htm; official Q&A, https://www.cac.gov.cn/2026-10/23/c_1794509044440601.htm.
Ministry of Industry and Information Technology and nine other departments, Measures for AI Science and Technology Ethics Review and Services (Trial), annexed expert re-review list, 20 March 2026, https://www.miit.gov.cn/jgsj/kjs/wjfb/art/2026/art_2995f16b28504ddcbb604e918eb15759.html.
Provisions on the Administration of Algorithmic Recommendation for Internet Information Services, art. 24, https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm; Provisions on the Administration of Deep Synthesis for Internet Information Services, art. 19, https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm; Interim Measures for the Management of Generative AI Services, art. 17, https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm.
Measures for AI Science and Technology Ethics Review and Services (Trial), art. 26, 20 March 2026, https://www.miit.gov.cn/jgsj/kjs/wjfb/art/2026/art_2995f16b28504ddcbb604e918eb15759.html.
Provisions on the Administration of Algorithmic Recommendation for Internet Information Services, art. 7, https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm; Provisions on the Administration of Deep Synthesis for Internet Information Services, art. 7, https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm; Interim Measures for the Management of AI Anthropomorphic Interaction Services, art. 9, https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm; Interim Measures for the Management of Generative AI Services, art. 4, https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm.
